Continuous- Variable Quantum Key Distribution with Entanglement in the Middle 
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We analyze the performance of continuous-variable quantum key distribution protocols where the entangled 
source originates not from one of the trusted parties, Alice or Bob, but from the malicious eavesdropper in the 
middle. This is in contrast to the typical simulations where Alice creates the entangled source and sends it 
over an insecure quantum channel to Bob. By using previous techniques and identifying certain error correction 
protocol equivalences, we show that Alice and Bob do not need to trust their source, and can still generate a 
positive key rate. Such a situation can occur in a quantum network where the untrusted source originated in 
between the two users. 
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I. INTRODUCTION 

Quantum key distribution (QKD) [1] provides a way for 
two people, Alice and Bob, to communicate secretly over an 
insecure quantum channel. The continuous-variable version 
of QKD | 2] provides an exciting alternative to the original 
discrete-variable schemes. Continuous variables offer higher 
detection efficiencies, off-the-shelf lasers for sources, and the 
potential to be conveniently integrated into current telecom- 
munication systems. Theoretically, the use of Gaussian re- 
sources, operations, and measurements, offer a simple way of 
analyzing the security of such protocols. 

Significant progress has been made in continuous-variable 
QKD over the years |2|]. More recent results include, 
the first experimental demonstration of entanglement-based 
continuous-variable QKD [3], as well as finite-size key ef- 
fects with composability using squeezed states 101, and im- 
proved higher efficiency error correcting codes [5|. In the 
performance analysis of continuous-variable QKD protocols 
thus far, it is the typical assumption that the source of the 
QKD protocol is created by one of the honest parties, e.g., 
Alice, and independent of the eavesdropper, Eve. However, 
having Eve being the source of the entanglement has long 
been a staple of theoretical discrete-variable QKD |@], espe- 
cially with respect to security proofs |Q1 f/T-Holl. and practical 
demonstrations |[TTl - [T3ll . On the other hand, explicitly cal- 
culating the secret key rates in such a situation has not been 
considered in continuous-variable QKD, even though bene- 
fits such as higher tolerance to loss have been observed in 
discrete-variable QKD ifTTl IT^fl . 

In this paper, we ask the question: "does having the en- 
tangled source originating from the middle, improve the per- 
formance of continuous-variable QKD protocols as it does in 
certain discrete-variable protocols?". Hence, we consider the 
continuous-variable situation where Eve is placed in the mid- 
dle between Alice and Bob, and is given full control of the 
creation of the Gaussian entangled resource. Using previous 
analytical techniques (e.g., see ifTill ). we show that in such 



a situation, a secure key can still be generated between Al- 
ice and Bob. Furthermore, our analysis uncovers the relation- 
ships and equivalences between the error correction protocols, 
direct lfl5ll and reverse reconciliation iflrSll . For example, di- 
rect reconciliation using coherent states and homodyne detec- 
tion is shown to be equivalent to reverse reconciliation using 
squeezed states and heterodyne detection when the entangle- 
ment is placed in the middle. In such a situation, from one 
perspective, direct reconciliation is improved and can beat the 
3 dB loss limit, while from another, it is simply a worse off 
version of reverse reconciliation (e.g., reverse reconciliation 
with excess channel noise). This highlights the differences 
between discrete and continuous-variable QKD, particularly 
in how loss on the channel affects each of them. 

This paper is structured as follows. In Sec. II, we describe 
the entanglement in the middle scheme followed by the equiv- 
alences of the error correcting protocols in Sec. III. In Sec. IV, 
we derive the secret key rates of various protocols where the 
entanglement originated from Eve in the middle. We follow 
this with a discussion of our results in Sec. V and offer con- 
cluding remarks in Sec. VI. 
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FIG. 1: Schematic of a continuous- variable QKD protocol where the 
entangled source of variance V (potentially created by Eve) is placed 
in the middle between Alice and Bob. Eve's attack consists of two 
entangling doner attacks on either side of the source (see text for 
further details). Alice and Bob can either perform homodyne or het- 
erodyne detection, using either direct or reverse reconciliation. Note 
that the usual situation of a trusted source (i.e., a source originating 
from Alice's station) can simply be recovered by setting Ti = 1. 
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II. ENTANGLEMENT IN THE MIDDLE 

We begin by first describing the entanglement in the mid- 
dle scheme. An entangled Gaussian resource is placed in the 
middle between Alice and Bob, see Fig.Q] This resource is to 
be used by Alice and Bob to generate a secure key which can 
then be used to encrypt data [1]. In principle, this resource 
could have been created by some third party, say Charlie, in 
installing an entangled source between two users in a quan- 
tum network. However, it is better to err on the side of cau- 
tion and assume that Eve could have also created this entan- 
gled state. We also assume that this entangled source is Gaus- 
sian. This is because the source is usually a Gaussian state and 
can thus maximize the Shannon mutual information and from 
an eavesdropping point of view, a Gaussian attack maximizes 
the eavesdropper's extractable information lfl7l [Till . In her 
attack, Eve perfectly replaces the quantum channel between 
Alice and Bob with her own quantum channel where the loss 
is simulated by two separate beam splitters with transmissions 
T\ and T2, where Tj g [0, 1]. When these two transmissions 
are symmetric, i.e., T± — T2, we say that the entanglement is 
in the middle of Alice and Bob. 

Eve's EPR state has two entangled modes described in the 
Heisenberg picture as X epr \ (sent to Alice) and X epr 2 (sent 
to Bob). Such a state is created by combining two orthogonal 
squeezed states, X s \ and X S 2, on a 50/50 beam splitter, i.e., 



(1) 



X ep rl — (X s i + X S 2) /\2, 
X e pr2 = (X s l — X s2 )/V2. 



Also V is the symmetrized variance of each of the two en- 
tangled modes, i.e., V := V(X epr i) = V(X epr 2). We also 
assume Eve's attack is perfect, i.e., no unknown noise on her 
input and output states. Note that when T\ = 1 we can re- 
cover the usual QKD situation where Alice creates the entan- 
gled state safely at her station. For each of these beam split- 
ters, Eve performs a collective Gaussian attack lfl7l - IT9l . We 
assume Eve uses such an attack in our new protocol, because 
it was shown, up to a suitable symmetrization of the protocols, 
that this type of attack is the best attack allowed by the laws of 
quantum physics for standard direct and reverse reconciliation 
protocols |23| . It consists in Eve interacting her independent 
ancilla modes with Alice and Bob's resultant modes for each 
run of the protocol in such a way to generate a memoryless 
Gaussian channel. 

The most common example of a collective Gaussian attack 
is the entangling doner [21]. This consists in Eve prepar- 
ing (for each of the two beam splitter attacks) ancilla modes 
Xe and X E from an entangled Gaussian state with variance 
W. Eve keeps one mode X E and injects the other mode Xe 
into the unused port of the beam splitter, leading to the out- 
put mode X' E . These operations are repeated identically and 
independently for each of the signal modes sent out to Alice 
and Bob. Eve's output modes are then stored in a quantum 
computer and detected collectively at the end of the proto- 
col. Eve's final measurement is optimized based on Alice and 
Bob's classical communications. 



Finally, we note that in continuous-variable QKD, in order 
for Alice and Bob to perform their quadrature measurements 
via homodyne or heterodyne detection, they need a reference 
pulse known as a local oscillator. This allows them to cor- 
rectly measure a quadrature with respect to the other orthog- 
onal quadrature. However, the local oscillator can be simply 
thought of as a classical signal and can therefore be considered 
an authenticated classical signal 1I22I1 . So in principal, when 
the source originates from the middle, Alice can first create a 
local oscillator and send it onto Bob. 
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FIG. 2: An example of a family of eight protocols [23] in continuous- 
variable QKD. Alice can choose between two states to send to Bob, 
who can in turn choose between two types of measurements. Finally 
there are two one-way error correction protocols Alice and B ob can 
use. 



III. EQUIVALENCES BETWEEN DIRECT AND REVERSE 
RECONCILIATION 



The first result of this paper is to show that a number of 
equivalences occur between the error correction protocols di- 
rect reconciliation |[T5ll and reverse reconciliation |fl6l , when 
entanglement is placed in the middle. To understand this, it is 
first helpful to understand how the entanglement-based picture 
works in continuous variables [14]. Suppose Alice and Bob 
share an entangled bi-partite Gaussian state. Then if Alice 
performs homodyne detection (and therefore gets one mea- 
surement result, q or p) on her half of the EPR pair then Bob's 
half collapses to a squeezed state. On the other hand, if Alice 
performs heterodyne detection (and thus gets two measure- 
ment results, q and p), Bob's mode collapses to a coherent 
state. So in the prepare-and-measure scheme, it is as though 
Alice had initially sent Bob a randomly displaced squeezed 
(coherent) state, respectively. As for the reconciliation pro- 
tocols, when we talk about direct (reverse) reconciliation it 
means that Bob (Alice) is trying to estimate what Alice (Bob) 
has measured. Hence, in direct (reverse) reconciliation Alice 
(Bob) is the reference point. In total then, with the state prepa- 
ration, detection and error correction, we end up with a family 
of eight protocols l23ll . i.e., one could choose either squeezed 
or coherent states with either direct or reverse reconciliation 
using either homodyne or heterodyne detection (cf. Fig. [2). 

We naturally find certain equivalences between the eight 
protocols, when entanglement is in the middle, based on the 
type of measurement Alice and Bob perform. To work out 
the equivalences simply determine the number of measure- 
ment outcomes Alice and Bob get for each run of the protocol, 
e.g., if both perform homodyne each will have one measure- 
ment outcome, whereas with heterodyne detection both will 
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have two. If they each have the same number of measure- 
ment outcomes, then direct and reverse reconciliation proto- 
cols will be the same. For example, if the total number of 
measurements for each are two, meaning Alice prepared co- 
herent states and Bob performed heterodyne detection, then it 
really doesn't matter who we label as Alice and who we label 
as Bob. The protocol becomes symmetric as they both have 
two measurement outcomes, and hence who is the reference 
point is arbitrary and so, direct reconciliation equals reverse 
reconciliation. 

The explicit equivalences between the protocols, when en- 
tanglement is placed in the middle, are as follows: 

• Coherent states and homodyne with direct (reverse) is 
the same as squeezed states and heterodyne with reverse 
(direct). 

• Direct and reverse reconciliation are equivalent for 
squeezed states and homodyne and also for coherent 
states and heterodyne. 

In this paper, we show that out of the family of eight pro- 
tocols in total, coherent states and homodyne with direct, or 
equivalently, squeezed state and heterodyne with reverse, out- 
perform all other protocols when the source is placed in the 
middle. We will now calculate the secret key rates for the var- 
ious protocols using previously established techniques, e.g., 
see GJ|. 

IV. SECRET KEY RATES 

We will limit our calculations to direct reconciliation, as 
the calculations for reverse reconciliation can be automati- 
cally derived through the previously mentioned equivalences. 
The secret key rate for direct reconciliation is defined as 

K = S(A : B) - S(A : E), (2) 

where S(A : B) and S(A : E) = S(E) — S{E\A) are the mu- 
tual informations between Alice and Bob and Alice and Eve, 
respectively. We now go about calculating these quantities 
for the cases of Alice creating squeezed states and coherent 
states with Bob using either homodyne or heterodyne detec- 
tion l24ll . For more details of these calculations involving cor- 
relation matrices and symplectic spectra see JUG!!]- Note also 
that we assume Alice and Bob have perfect (100 % efficient) 
homodyne and heterodyne detectors. First we write Alice and 
Bob's covariance matrix H, which is given by 

^ AB = { cZ bl ) ' (3) 

where I and Z are the usual Pauli matrices and a = T\V + (1 — 
Ti)Wt, b = T 2 V + (1 - T 2 )W 2 , and c = s/T^^VV^l. 
This seemingly innocuous matrix will form the basis for most 
of our calculations. In fact, it is this matrix which takes into 
account Eve being in the middle (along with the requirements 
of the effective channel, T = T X T 2 , which will be used when 
plotting), because typically a = V. 



Note that the value T can be calculated by allowing an ar- 
bitrary mode Xi to go through two different beam splitters 
one after the other. For example, after the first beam splitter 
we have X 2 = \fT\Xi + — T\N\ and after the second 
beam splitter X 3 = y/T^X-2 + VI -T 2 N 2 . Back substituting 
and calculating the variances, gives the final required relation, 
T = T\T 2 , where Ni are the noise terms from the unused port 
of the beam splitters. 

A. Squeezed states 

Alice and Bob's mutual information, for squeezed 
states ll25l l26ll with homodyne detection, is given by 
\\og 2 {V A /V A \ B ),i.e., 

S(A:B)= 1 -lo g2 (^ Jl ), (4) 

for heterodyne is given by 

^:B) = llog 2 ( a _ c2/ a (6 + 1) ). (5) 

We will now calculate Eve's mutual information with Bob, 
S(A : E) = S(E) - S(E\A), which is exactly the same for 
both homodyne and heterodyne detection. This is because, as 
we are using direct reconciliation, it is conditioned on Alice's 
measurement results and not Bob's. This simplification illus- 
trates the beauty of the entanglement-based scheme. Note that 
because Eve provides a purification of Alice and Bob's den- 
sity matrix we can write S(E) = S(AB). Therefore, we have 
S{AB) = G[(Ai - l)/2] + G[(A 2 - l)/2] where 

G(x) = (a; + l)log 2 (x + l)-a;log 2 x, (6) 

and where the symplectic eigenvalues are given by 

A?, 2 = i[A± v / A 2 -4 J D 2 ], (7) 

where A = a 2 + b 2 + c 2 and D = ab - c 2 HQ. Again 
using the same purification argument we can write S(E\ A) = 
S(B\A). Again to calculate S(B\ A) we calculate Bob's cor- 
relation matrix conditioned on Alice's measurement outcome 
x a which is calculated using J2l 

i x b = is - o T AB (x 1A xy x G AB , (8) 

where the inverse is a pseudoinverse and the matrix X — 
[1,0; 0,0]. We find that S(B\A) = G[(A 3 - l)/2] where 
A§ = 6(6— c 2 /a). We now have enough information to numer- 
ically calculate and plot the secret key rate given in Eq. (O, but 
first we calculate the coherent state case. 



B. Coherent states 

Alice and Bob's mutual information, for coherent states 
with homodyne detection, is given by 

^■■^=i^ 2 (^T^y ^ 
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and for heterodyne detection it is 



S(A : B) = log 2 ( 



b+l -c 2 /(a + 1) 



(10) 



As before, the next step is to calculate Eve's mutual informa- 
tion with Alice. Now in the previous case of squeezed states, 
we only needed to calculate one expression for Eve's mutual 
information with Alice which could then be used for both the 
homodyne and heterodyne detection cases. However, this is 
not possible in the case of coherent states, as Alice's measure- 
ment is different depending on whether Bob does homodyne 
or heterodyne detection. This is because Alice discards one 
of her measurement results during the sifting phase of homo- 
dyne and keeps both during heterodyne. Therefore two sepa- 
rate calculations needs to be performed. Firstly, the homodyne 
detection case. To create a coherent state, Alice performs het- 
erodyne detection on her mode using a 50/50 beam splitter 
(BS) which introduces vacuum noise denoted by system C. 
This interaction on the initial correlation matrix 7a c b can 
be described by the following symplectic transformation lUt] 
Iacb = [S%$ ® Ib] T 1a c b[Sac ® I b\- Using the previ- 
ous purification arguments, we find that S(E\A) — S(BC\A) 
as, after Alice's measurement, the system BCE is pure. The 
correlation matrix of the system BC conditioned on Alice's 
measurement result is calculated to be 




FIG. 3: Plot of direct reconciliation using homodyne detection with 
(a) coherent states and (b) squeezed states. Solid (red) line: entan- 
glement in the middle; Dashed (blue) line: entanglement at Alice's 
station. By giving Eve control of the entangled source and by plac- 
ing it in the middle of Alice and Bob we are still able to generate a 
secure key. Due to the equivalences in the error correction protocols, 
this entanglement in the middle scenario can be seen as a direct rec- 
onciliation protocol beating the 3 dB loss limit using coherent states 
or alternatively, a reverse reconciliation protocol with excess channel 
noise. 
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The conditional von Neumann entropy can be written as 

S(BC\A) = G[(A 3 - l)/2] + G[(A 4 - l)/2] where 



\ 2 

A 3,4 



= hA±VA*-4B], 



(11) 



with A = (a + bD + A)/(a + l) and B = D(b + D)/(a + l) 
with D and A defined previously. 

We now calculate Eve's mutual information in the case 
of Bob performing heterodyne detection. Using ^ a,p ° = 
7s - C{X 1AC X)- 1 C T gives i% c = [b - c 2 /(a + 1)]I. 
The conditional von Neumann entropy is given by S(E\ A) = 
S(B\A) = G[(A 3 -l)/2] where A 3 = b-c 2 /(a + l). We can 
now calculate the final secret key rate for the coherent state 
protocols and plot them with the squeezed states protocols. 



V. RESULTS AND DISCUSSION 

Using the previous section's results we can plot the secret 
key rates for the various protocols over a lossy channel. We 
find that out of the family of eight protocols in total, coherent 
states and homodyne with direct, or equivalently, squeezed 
state and heterodyne with reverse, outperform all other proto- 
cols when the source is placed in the middle. In Fig. [3] we 
plot the cases of homodyne detection for (a) coherent states 
and (b) squeezed states where the dashed lines indicate the 
usual case where Alice controls the entangled source, while 
the solid lines indicate the entanglement in the middle situa- 
tion. We can see that in both the coherent state and squeezed 
state cases, even though Eve controls the source, both proto- 
cols are still secure. We also notice that the entanglement in 
the middle schemes can go past the 3 dB loss limit of direct 
reconciliation. In the equivalences between direct and reverse 
reconciliation protocols, this can be looked at as a (coherent 
state) direct reconciliation protocol beating the 3 dB loss limit 
or, alternatively, a (squeeze state) reverse reconciliation proto- 
col performing poorly, i.e., with (equivalent) additional excess 
channel noise on the channel. Remember that the squeezed 
state protocol using reverse reconciliation does not have a loss 
limit and, for a lossy channel, is secure for all values of chan- 
nel transmissions. We note that the heterodyne cases are not 
plotted here but are also secure when the source originates 
from Eve. Also the effect of excess noise on the quantum 
channel, has the typical effect of reducing the security of the 
protocol as a function of the excess noise value. 

The analysis in this paper highlights the differences be- 
tween discrete-variable QKD and continuous-variable QKD. 
This is because in discrete variables, placing the entanglement 
in the middle allows the QKD protocol to tolerate higher lev- 
els of loss (in fact, the distance can be double). However, in 
continuous variables, we do see an advantage in tolerance to 
loss but because of the symmetry in error correction protoco Is, 
one could look at it as another protocol performing badly. A 
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kind of the glass is half full half empty scenario. Perhaps the 
main difference lies in the definition of loss. In discrete vari- 
ables, loss simply means the photon did not arrive and was 
lost to the environment. Whereas, in continuous variables loss 
means additional Gaussian noise on the quantum channel, and 
are thus unable to simply postselect out the times when loss 
occurs. 



VI. CONCLUSION 

In conclusion, we have analyzed the performance of eight 
continuous-variable QKD protocols where the source of the 
protocol originates from the malicious eavesdropper who is in 
the middle between Alice and Bob. This is in direct contrast 
to the typical scenario where Alice usually creates the source 
at her secure station. We showed that a secure key can still 
be achieved even when Eve controls such a source. We also 



pointed out the various error correction protocols equivalences 
that occur when the entanglement is placed in the middle. In 
terms of possible future research, it would be interesting to 
look at the entanglement in the middle scheme from the point 
of view of the postselection error correction protocol aZli . 
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